_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T19:57:41.3072903Z'/><EventRecordID>744233</EventRecordID><Correlation/><Execution ProcessID='6056' ThreadID='5380'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-09 19:57:41.288</Data><Data Name='ProcessGuid'>{108affa0-5db5-6961-cc3a-000000000800}</Data><Data Name='ProcessId'>7044</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{108affa0-e249-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{108affa0-5db4-6961-cb3a-000000000800}</Data><Data Name='ParentProcessId'>6336</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T19:56:42.5778098Z'/><EventRecordID>26752</EventRecordID><Correlation/><Execution ProcessID='5540' ThreadID='5704'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-09 19:56:42.575</Data><Data Name='ProcessGuid'>{09708317-5d7a-6961-d73a-000000000800}</Data><Data Name='ProcessId'>2644</Data><Data Name='Image'>C:\Windows\System32\findstr.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Find String (QGREP) Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>FINDSTR.EXE</Data><Data Name='CommandLine'>findstr  /r "LISTENING"</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{09708317-e1f4-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=7E484985CC835B3892F7445D2692227BA2D2E6F5,MD5=D0A20941751521C0D19BD3EABF34C446,SHA256=940CBEC6750076F2A191CBC8DA96AAE1905F7D9709B48C839BBD52884EFF1A45,IMPHASH=A27641A39DA5A6B0717E06BA00E56B7F</Data><Data Name='ParentProcessGuid'>{09708317-5d7a-6961-d53a-000000000800}</Data><Data Name='ParentProcessId'>5152</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>

_sourcetype: XmlWinEventLog

sourcetype: XmlWinEventLog


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T19:56:42.5678579Z'/><EventRecordID>26751</EventRecordID><Correlation/><Execution ProcessID='5540' ThreadID='5704'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1049,technique_name=System Network Connections Discovery</Data><Data Name='UtcTime'>2026-01-09 19:56:42.564</Data><Data Name='ProcessGuid'>{09708317-5d7a-6961-d63a-000000000800}</Data><Data Name='ProcessId'>3556</Data><Data Name='Image'>C:\Windows\System32\NETSTAT.EXE</Data><Data Name='FileVersion'>10.0.20348.3451 (WinBuild.160101.0800)</Data><Data Name='Description'>TCP/IP Netstat Command</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>netstat.exe</Data><Data Name='CommandLine'>netstat  -nao </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{09708317-e1f4-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2B36D7C03533E8B3DBDEC15DBB173BCB69DB2239,MD5=BDDFB67C57B9C131E5E2927C587A13ED,SHA256=8AD63014D94CF150B19B3AF2E9C5FF5EC19B7ACAFF49D97AFD3AC4C34B9DF4F8,IMPHASH=0621372A264AC3B58A59C2C28375CA74</Data><Data Name='ParentProcessGuid'>{09708317-5d7a-6961-d53a-000000000800}</Data><Data Name='ParentProcessId'>5152</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T19:56:41.6296627Z'/><EventRecordID>26724</EventRecordID><Correlation/><Execution ProcessID='5540' ThreadID='5704'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1057,technique_name=Process Discovery</Data><Data Name='UtcTime'>2026-01-09 19:56:41.601</Data><Data Name='ProcessGuid'>{09708317-5d79-6961-d13a-000000000800}</Data><Data Name='ProcessId'>6752</Data><Data Name='Image'>C:\Windows\System32\tasklist.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Lists the current running tasks</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>tasklist.exe</Data><Data Name='CommandLine'>tasklist  /nh /fo csv</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{09708317-e1f4-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=A440302FCCCB6D181F8DB017265602397E1EB92A,MD5=2B05A9BDFAEAC5743B47A10F3F0A202B,SHA256=31E6A056EB1E722D8EC8C7E152E6A410B12D6055140BC38FFA1CCBD56AD4E623,IMPHASH=FCEA32ABE79C10DFACC88F5335DD89DE</Data><Data Name='ParentProcessGuid'>{09708317-5d79-6961-ce3a-000000000800}</Data><Data Name='ParentProcessId'>7108</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c tasklist /nh /fo csv</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T19:56:40.9678035Z'/><EventRecordID>26714</EventRecordID><Correlation/><Execution ProcessID='5540' ThreadID='5704'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-09 19:56:40.961</Data><Data Name='ProcessGuid'>{09708317-5d78-6961-cc3a-000000000800}</Data><Data Name='ProcessId'>7148</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{09708317-e1f4-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{09708317-5d78-6961-cb3a-000000000800}</Data><Data Name='ParentProcessId'>6724</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T19:55:45.6208351Z'/><EventRecordID>29116</EventRecordID><Correlation/><Execution ProcessID='3488' ThreadID='3148'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-09 19:55:45.614</Data><Data Name='ProcessGuid'>{b5ee82db-5d41-6961-273b-000000000800}</Data><Data Name='ProcessId'>1644</Data><Data Name='Image'>C:\Windows\System32\findstr.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Find String (QGREP) Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>FINDSTR.EXE</Data><Data Name='CommandLine'>findstr  /r "LISTENING"</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{b5ee82db-e203-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=7E484985CC835B3892F7445D2692227BA2D2E6F5,MD5=D0A20941751521C0D19BD3EABF34C446,SHA256=940CBEC6750076F2A191CBC8DA96AAE1905F7D9709B48C839BBD52884EFF1A45,IMPHASH=A27641A39DA5A6B0717E06BA00E56B7F</Data><Data Name='ParentProcessGuid'>{b5ee82db-5d41-6961-253b-000000000800}</Data><Data Name='ParentProcessId'>6200</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T19:55:45.6130062Z'/><EventRecordID>29115</EventRecordID><Correlation/><Execution ProcessID='3488' ThreadID='3148'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1049,technique_name=System Network Connections Discovery</Data><Data Name='UtcTime'>2026-01-09 19:55:45.603</Data><Data Name='ProcessGuid'>{b5ee82db-5d41-6961-263b-000000000800}</Data><Data Name='ProcessId'>6432</Data><Data Name='Image'>C:\Windows\System32\NETSTAT.EXE</Data><Data Name='FileVersion'>10.0.20348.3451 (WinBuild.160101.0800)</Data><Data Name='Description'>TCP/IP Netstat Command</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>netstat.exe</Data><Data Name='CommandLine'>netstat  -nao </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{b5ee82db-e203-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2B36D7C03533E8B3DBDEC15DBB173BCB69DB2239,MD5=BDDFB67C57B9C131E5E2927C587A13ED,SHA256=8AD63014D94CF150B19B3AF2E9C5FF5EC19B7ACAFF49D97AFD3AC4C34B9DF4F8,IMPHASH=0621372A264AC3B58A59C2C28375CA74</Data><Data Name='ParentProcessGuid'>{b5ee82db-5d41-6961-253b-000000000800}</Data><Data Name='ParentProcessId'>6200</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T19:55:45.0908075Z'/><EventRecordID>29106</EventRecordID><Correlation/><Execution ProcessID='3488' ThreadID='3148'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1057,technique_name=Process Discovery</Data><Data Name='UtcTime'>2026-01-09 19:55:45.083</Data><Data Name='ProcessGuid'>{b5ee82db-5d41-6961-223b-000000000800}</Data><Data Name='ProcessId'>1124</Data><Data Name='Image'>C:\Windows\System32\tasklist.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Lists the current running tasks</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>tasklist.exe</Data><Data Name='CommandLine'>tasklist  /nh /fo csv</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{b5ee82db-e203-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=A440302FCCCB6D181F8DB017265602397E1EB92A,MD5=2B05A9BDFAEAC5743B47A10F3F0A202B,SHA256=31E6A056EB1E722D8EC8C7E152E6A410B12D6055140BC38FFA1CCBD56AD4E623,IMPHASH=FCEA32ABE79C10DFACC88F5335DD89DE</Data><Data Name='ParentProcessGuid'>{b5ee82db-5d41-6961-213b-000000000800}</Data><Data Name='ParentProcessId'>3324</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c tasklist /nh /fo csv</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T19:55:44.1675548Z'/><EventRecordID>29058</EventRecordID><Correlation/><Execution ProcessID='3488' ThreadID='3148'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-09 19:55:44.150</Data><Data Name='ProcessGuid'>{b5ee82db-5d40-6961-1f3b-000000000800}</Data><Data Name='ProcessId'>5452</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{b5ee82db-e203-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{b5ee82db-5d40-6961-1d3b-000000000800}</Data><Data Name='ParentProcessId'>6788</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T19:55:32.2111370Z'/><EventRecordID>26845</EventRecordID><Correlation/><Execution ProcessID='5908' ThreadID='5696'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-09 19:55:32.209</Data><Data Name='ProcessGuid'>{d79348b5-5d34-6961-e43a-000000000800}</Data><Data Name='ProcessId'>6856</Data><Data Name='Image'>C:\Windows\System32\findstr.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Find String (QGREP) Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>FINDSTR.EXE</Data><Data Name='CommandLine'>findstr  /r "LISTENING"</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{d79348b5-e1c4-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=7E484985CC835B3892F7445D2692227BA2D2E6F5,MD5=D0A20941751521C0D19BD3EABF34C446,SHA256=940CBEC6750076F2A191CBC8DA96AAE1905F7D9709B48C839BBD52884EFF1A45,IMPHASH=A27641A39DA5A6B0717E06BA00E56B7F</Data><Data Name='ParentProcessGuid'>{d79348b5-5d34-6961-e23a-000000000800}</Data><Data Name='ParentProcessId'>6516</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T19:55:32.2101728Z'/><EventRecordID>26844</EventRecordID><Correlation/><Execution ProcessID='5908' ThreadID='5696'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1049,technique_name=System Network Connections Discovery</Data><Data Name='UtcTime'>2026-01-09 19:55:32.202</Data><Data Name='ProcessGuid'>{d79348b5-5d34-6961-e33a-000000000800}</Data><Data Name='ProcessId'>6976</Data><Data Name='Image'>C:\Windows\System32\NETSTAT.EXE</Data><Data Name='FileVersion'>10.0.20348.3451 (WinBuild.160101.0800)</Data><Data Name='Description'>TCP/IP Netstat Command</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>netstat.exe</Data><Data Name='CommandLine'>netstat  -nao </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{d79348b5-e1c4-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2B36D7C03533E8B3DBDEC15DBB173BCB69DB2239,MD5=BDDFB67C57B9C131E5E2927C587A13ED,SHA256=8AD63014D94CF150B19B3AF2E9C5FF5EC19B7ACAFF49D97AFD3AC4C34B9DF4F8,IMPHASH=0621372A264AC3B58A59C2C28375CA74</Data><Data Name='ParentProcessGuid'>{d79348b5-5d34-6961-e23a-000000000800}</Data><Data Name='ParentProcessId'>6516</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T19:55:31.2823477Z'/><EventRecordID>26819</EventRecordID><Correlation/><Execution ProcessID='5908' ThreadID='5696'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1057,technique_name=Process Discovery</Data><Data Name='UtcTime'>2026-01-09 19:55:31.278</Data><Data Name='ProcessGuid'>{d79348b5-5d33-6961-e03a-000000000800}</Data><Data Name='ProcessId'>3448</Data><Data Name='Image'>C:\Windows\System32\tasklist.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Lists the current running tasks</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>tasklist.exe</Data><Data Name='CommandLine'>tasklist  /nh /fo csv</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{d79348b5-e1c4-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=A440302FCCCB6D181F8DB017265602397E1EB92A,MD5=2B05A9BDFAEAC5743B47A10F3F0A202B,SHA256=31E6A056EB1E722D8EC8C7E152E6A410B12D6055140BC38FFA1CCBD56AD4E623,IMPHASH=FCEA32ABE79C10DFACC88F5335DD89DE</Data><Data Name='ParentProcessGuid'>{d79348b5-5d33-6961-df3a-000000000800}</Data><Data Name='ParentProcessId'>6280</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c tasklist /nh /fo csv</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T19:55:30.4704435Z'/><EventRecordID>26806</EventRecordID><Correlation/><Execution ProcessID='5908' ThreadID='5696'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-09 19:55:30.460</Data><Data Name='ProcessGuid'>{d79348b5-5d32-6961-d83a-000000000800}</Data><Data Name='ProcessId'>6524</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{d79348b5-e1c4-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{d79348b5-5d32-6961-d73a-000000000800}</Data><Data Name='ParentProcessId'>6716</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T19:54:33.9584987Z'/><EventRecordID>26883</EventRecordID><Correlation/><Execution ProcessID='5644' ThreadID='5744'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-09 19:54:33.920</Data><Data Name='ProcessGuid'>{ef899ae0-5cf9-6961-633a-000000000800}</Data><Data Name='ProcessId'>1668</Data><Data Name='Image'>C:\Windows\System32\findstr.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Find String (QGREP) Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>FINDSTR.EXE</Data><Data Name='CommandLine'>findstr  /r "LISTENING"</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{ef899ae0-e138-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=7E484985CC835B3892F7445D2692227BA2D2E6F5,MD5=D0A20941751521C0D19BD3EABF34C446,SHA256=940CBEC6750076F2A191CBC8DA96AAE1905F7D9709B48C839BBD52884EFF1A45,IMPHASH=A27641A39DA5A6B0717E06BA00E56B7F</Data><Data Name='ParentProcessGuid'>{ef899ae0-5cf9-6961-613a-000000000800}</Data><Data Name='ParentProcessId'>5348</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T19:54:33.9173343Z'/><EventRecordID>26882</EventRecordID><Correlation/><Execution ProcessID='5644' ThreadID='5744'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1049,technique_name=System Network Connections Discovery</Data><Data Name='UtcTime'>2026-01-09 19:54:33.864</Data><Data Name='ProcessGuid'>{ef899ae0-5cf9-6961-623a-000000000800}</Data><Data Name='ProcessId'>6340</Data><Data Name='Image'>C:\Windows\System32\NETSTAT.EXE</Data><Data Name='FileVersion'>10.0.20348.3451 (WinBuild.160101.0800)</Data><Data Name='Description'>TCP/IP Netstat Command</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>netstat.exe</Data><Data Name='CommandLine'>netstat  -nao </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{ef899ae0-e138-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2B36D7C03533E8B3DBDEC15DBB173BCB69DB2239,MD5=BDDFB67C57B9C131E5E2927C587A13ED,SHA256=8AD63014D94CF150B19B3AF2E9C5FF5EC19B7ACAFF49D97AFD3AC4C34B9DF4F8,IMPHASH=0621372A264AC3B58A59C2C28375CA74</Data><Data Name='ParentProcessGuid'>{ef899ae0-5cf9-6961-613a-000000000800}</Data><Data Name='ParentProcessId'>5348</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T19:54:33.1805689Z'/><EventRecordID>26868</EventRecordID><Correlation/><Execution ProcessID='5644' ThreadID='5744'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1057,technique_name=Process Discovery</Data><Data Name='UtcTime'>2026-01-09 19:54:33.175</Data><Data Name='ProcessGuid'>{ef899ae0-5cf9-6961-5e3a-000000000800}</Data><Data Name='ProcessId'>3352</Data><Data Name='Image'>C:\Windows\System32\tasklist.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Lists the current running tasks</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>tasklist.exe</Data><Data Name='CommandLine'>tasklist  /nh /fo csv</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{ef899ae0-e138-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=A440302FCCCB6D181F8DB017265602397E1EB92A,MD5=2B05A9BDFAEAC5743B47A10F3F0A202B,SHA256=31E6A056EB1E722D8EC8C7E152E6A410B12D6055140BC38FFA1CCBD56AD4E623,IMPHASH=FCEA32ABE79C10DFACC88F5335DD89DE</Data><Data Name='ParentProcessGuid'>{ef899ae0-5cf9-6961-5d3a-000000000800}</Data><Data Name='ParentProcessId'>6248</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c tasklist /nh /fo csv</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T19:54:32.8027454Z'/><EventRecordID>26859</EventRecordID><Correlation/><Execution ProcessID='5644' ThreadID='5744'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-09 19:54:32.792</Data><Data Name='ProcessGuid'>{ef899ae0-5cf8-6961-5a3a-000000000800}</Data><Data Name='ProcessId'>4544</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{ef899ae0-e138-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{ef899ae0-5cf8-6961-593a-000000000800}</Data><Data Name='ParentProcessId'>6692</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T19:54:11.7854692Z'/><EventRecordID>27123</EventRecordID><Correlation/><Execution ProcessID='6020' ThreadID='6136'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-09 19:54:11.783</Data><Data Name='ProcessGuid'>{8c932ff3-5ce3-6961-f63a-000000000800}</Data><Data Name='ProcessId'>6940</Data><Data Name='Image'>C:\Windows\System32\findstr.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Find String (QGREP) Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>FINDSTR.EXE</Data><Data Name='CommandLine'>findstr  /r "LISTENING"</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{8c932ff3-e182-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=7E484985CC835B3892F7445D2692227BA2D2E6F5,MD5=D0A20941751521C0D19BD3EABF34C446,SHA256=940CBEC6750076F2A191CBC8DA96AAE1905F7D9709B48C839BBD52884EFF1A45,IMPHASH=A27641A39DA5A6B0717E06BA00E56B7F</Data><Data Name='ParentProcessGuid'>{8c932ff3-5ce3-6961-f43a-000000000800}</Data><Data Name='ParentProcessId'>6208</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T19:54:11.7777475Z'/><EventRecordID>27122</EventRecordID><Correlation/><Execution ProcessID='6020' ThreadID='6136'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1049,technique_name=System Network Connections Discovery</Data><Data Name='UtcTime'>2026-01-09 19:54:11.774</Data><Data Name='ProcessGuid'>{8c932ff3-5ce3-6961-f53a-000000000800}</Data><Data Name='ProcessId'>3040</Data><Data Name='Image'>C:\Windows\System32\NETSTAT.EXE</Data><Data Name='FileVersion'>10.0.20348.3451 (WinBuild.160101.0800)</Data><Data Name='Description'>TCP/IP Netstat Command</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>netstat.exe</Data><Data Name='CommandLine'>netstat  -nao </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{8c932ff3-e182-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2B36D7C03533E8B3DBDEC15DBB173BCB69DB2239,MD5=BDDFB67C57B9C131E5E2927C587A13ED,SHA256=8AD63014D94CF150B19B3AF2E9C5FF5EC19B7ACAFF49D97AFD3AC4C34B9DF4F8,IMPHASH=0621372A264AC3B58A59C2C28375CA74</Data><Data Name='ParentProcessGuid'>{8c932ff3-5ce3-6961-f43a-000000000800}</Data><Data Name='ParentProcessId'>6208</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T19:54:10.7486405Z'/><EventRecordID>27095</EventRecordID><Correlation/><Execution ProcessID='6020' ThreadID='6136'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1057,technique_name=Process Discovery</Data><Data Name='UtcTime'>2026-01-09 19:54:10.745</Data><Data Name='ProcessGuid'>{8c932ff3-5ce2-6961-f13a-000000000800}</Data><Data Name='ProcessId'>5564</Data><Data Name='Image'>C:\Windows\System32\tasklist.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Lists the current running tasks</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>tasklist.exe</Data><Data Name='CommandLine'>tasklist  /nh /fo csv</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{8c932ff3-e182-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=A440302FCCCB6D181F8DB017265602397E1EB92A,MD5=2B05A9BDFAEAC5743B47A10F3F0A202B,SHA256=31E6A056EB1E722D8EC8C7E152E6A410B12D6055140BC38FFA1CCBD56AD4E623,IMPHASH=FCEA32ABE79C10DFACC88F5335DD89DE</Data><Data Name='ParentProcessGuid'>{8c932ff3-5ce2-6961-f03a-000000000800}</Data><Data Name='ParentProcessId'>4400</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c tasklist /nh /fo csv</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T19:54:10.2912730Z'/><EventRecordID>27084</EventRecordID><Correlation/><Execution ProcessID='6020' ThreadID='6136'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-09 19:54:10.237</Data><Data Name='ProcessGuid'>{8c932ff3-5ce2-6961-eb3a-000000000800}</Data><Data Name='ProcessId'>6876</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{8c932ff3-e182-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{8c932ff3-5ce2-6961-ea3a-000000000800}</Data><Data Name='ParentProcessId'>6248</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T19:53:38.2722544Z'/><EventRecordID>27239</EventRecordID><Correlation/><Execution ProcessID='5864' ThreadID='5760'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-09 19:53:38.270</Data><Data Name='ProcessGuid'>{22c61f07-5cc2-6961-f73a-000000000800}</Data><Data Name='ProcessId'>6008</Data><Data Name='Image'>C:\Windows\System32\findstr.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Find String (QGREP) Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>FINDSTR.EXE</Data><Data Name='CommandLine'>findstr  /r "LISTENING"</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{22c61f07-e16b-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=7E484985CC835B3892F7445D2692227BA2D2E6F5,MD5=D0A20941751521C0D19BD3EABF34C446,SHA256=940CBEC6750076F2A191CBC8DA96AAE1905F7D9709B48C839BBD52884EFF1A45,IMPHASH=A27641A39DA5A6B0717E06BA00E56B7F</Data><Data Name='ParentProcessGuid'>{22c61f07-5cc2-6961-f53a-000000000800}</Data><Data Name='ParentProcessId'>6660</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T19:53:38.2647159Z'/><EventRecordID>27238</EventRecordID><Correlation/><Execution ProcessID='5864' ThreadID='5760'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1049,technique_name=System Network Connections Discovery</Data><Data Name='UtcTime'>2026-01-09 19:53:38.261</Data><Data Name='ProcessGuid'>{22c61f07-5cc2-6961-f63a-000000000800}</Data><Data Name='ProcessId'>6016</Data><Data Name='Image'>C:\Windows\System32\NETSTAT.EXE</Data><Data Name='FileVersion'>10.0.20348.3451 (WinBuild.160101.0800)</Data><Data Name='Description'>TCP/IP Netstat Command</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>netstat.exe</Data><Data Name='CommandLine'>netstat  -nao </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{22c61f07-e16b-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2B36D7C03533E8B3DBDEC15DBB173BCB69DB2239,MD5=BDDFB67C57B9C131E5E2927C587A13ED,SHA256=8AD63014D94CF150B19B3AF2E9C5FF5EC19B7ACAFF49D97AFD3AC4C34B9DF4F8,IMPHASH=0621372A264AC3B58A59C2C28375CA74</Data><Data Name='ParentProcessGuid'>{22c61f07-5cc2-6961-f53a-000000000800}</Data><Data Name='ParentProcessId'>6660</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T19:53:37.3625362Z'/><EventRecordID>27211</EventRecordID><Correlation/><Execution ProcessID='5864' ThreadID='5760'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1057,technique_name=Process Discovery</Data><Data Name='UtcTime'>2026-01-09 19:53:37.358</Data><Data Name='ProcessGuid'>{22c61f07-5cc1-6961-f23a-000000000800}</Data><Data Name='ProcessId'>3864</Data><Data Name='Image'>C:\Windows\System32\tasklist.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Lists the current running tasks</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>tasklist.exe</Data><Data Name='CommandLine'>tasklist  /nh /fo csv</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{22c61f07-e16b-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=A440302FCCCB6D181F8DB017265602397E1EB92A,MD5=2B05A9BDFAEAC5743B47A10F3F0A202B,SHA256=31E6A056EB1E722D8EC8C7E152E6A410B12D6055140BC38FFA1CCBD56AD4E623,IMPHASH=FCEA32ABE79C10DFACC88F5335DD89DE</Data><Data Name='ParentProcessGuid'>{22c61f07-5cc1-6961-f03a-000000000800}</Data><Data Name='ParentProcessId'>6552</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c tasklist /nh /fo csv</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T19:53:36.8212027Z'/><EventRecordID>27201</EventRecordID><Correlation/><Execution ProcessID='5864' ThreadID='5760'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-09 19:53:36.809</Data><Data Name='ProcessGuid'>{22c61f07-5cc0-6961-ec3a-000000000800}</Data><Data Name='ProcessId'>6168</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{22c61f07-e16b-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{22c61f07-5cc0-6961-eb3a-000000000800}</Data><Data Name='ParentProcessId'>7020</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T19:53:18.7793079Z'/><EventRecordID>29726</EventRecordID><Correlation/><Execution ProcessID='2288' ThreadID='5448'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-09 19:53:18.777</Data><Data Name='ProcessGuid'>{677db45e-5cae-6961-f73b-000000000800}</Data><Data Name='ProcessId'>9524</Data><Data Name='Image'>C:\Windows\System32\findstr.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Find String (QGREP) Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>FINDSTR.EXE</Data><Data Name='CommandLine'>findstr  /r "LISTENING"</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{677db45e-e134-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=7E484985CC835B3892F7445D2692227BA2D2E6F5,MD5=D0A20941751521C0D19BD3EABF34C446,SHA256=940CBEC6750076F2A191CBC8DA96AAE1905F7D9709B48C839BBD52884EFF1A45,IMPHASH=A27641A39DA5A6B0717E06BA00E56B7F</Data><Data Name='ParentProcessGuid'>{677db45e-5cae-6961-f53b-000000000800}</Data><Data Name='ParentProcessId'>6952</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T19:53:18.7700848Z'/><EventRecordID>29725</EventRecordID><Correlation/><Execution ProcessID='2288' ThreadID='5448'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1049,technique_name=System Network Connections Discovery</Data><Data Name='UtcTime'>2026-01-09 19:53:18.767</Data><Data Name='ProcessGuid'>{677db45e-5cae-6961-f63b-000000000800}</Data><Data Name='ProcessId'>8896</Data><Data Name='Image'>C:\Windows\System32\NETSTAT.EXE</Data><Data Name='FileVersion'>10.0.20348.3451 (WinBuild.160101.0800)</Data><Data Name='Description'>TCP/IP Netstat Command</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>netstat.exe</Data><Data Name='CommandLine'>netstat  -nao </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{677db45e-e134-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2B36D7C03533E8B3DBDEC15DBB173BCB69DB2239,MD5=BDDFB67C57B9C131E5E2927C587A13ED,SHA256=8AD63014D94CF150B19B3AF2E9C5FF5EC19B7ACAFF49D97AFD3AC4C34B9DF4F8,IMPHASH=0621372A264AC3B58A59C2C28375CA74</Data><Data Name='ParentProcessGuid'>{677db45e-5cae-6961-f53b-000000000800}</Data><Data Name='ParentProcessId'>6952</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T19:53:17.7472013Z'/><EventRecordID>29718</EventRecordID><Correlation/><Execution ProcessID='2288' ThreadID='5448'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1057,technique_name=Process Discovery</Data><Data Name='UtcTime'>2026-01-09 19:53:17.735</Data><Data Name='ProcessGuid'>{677db45e-5cad-6961-f43b-000000000800}</Data><Data Name='ProcessId'>3832</Data><Data Name='Image'>C:\Windows\System32\tasklist.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Lists the current running tasks</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>tasklist.exe</Data><Data Name='CommandLine'>tasklist  /nh /fo csv</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{677db45e-e134-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=A440302FCCCB6D181F8DB017265602397E1EB92A,MD5=2B05A9BDFAEAC5743B47A10F3F0A202B,SHA256=31E6A056EB1E722D8EC8C7E152E6A410B12D6055140BC38FFA1CCBD56AD4E623,IMPHASH=FCEA32ABE79C10DFACC88F5335DD89DE</Data><Data Name='ParentProcessGuid'>{677db45e-5cad-6961-f33b-000000000800}</Data><Data Name='ParentProcessId'>8704</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c tasklist /nh /fo csv</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T19:53:16.7405526Z'/><EventRecordID>29702</EventRecordID><Correlation/><Execution ProcessID='2288' ThreadID='5448'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-09 19:53:16.730</Data><Data Name='ProcessGuid'>{677db45e-5cac-6961-f23b-000000000800}</Data><Data Name='ProcessId'>9592</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{677db45e-e134-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{677db45e-5cac-6961-f13b-000000000800}</Data><Data Name='ParentProcessId'>8560</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T19:51:15.4842270Z'/><EventRecordID>27094</EventRecordID><Correlation/><Execution ProcessID='1556' ThreadID='5000'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-09 19:51:15.481</Data><Data Name='ProcessGuid'>{43b9bf8b-5c33-6961-8f3a-000000000800}</Data><Data Name='ProcessId'>6888</Data><Data Name='Image'>C:\Windows\System32\findstr.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Find String (QGREP) Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>FINDSTR.EXE</Data><Data Name='CommandLine'>findstr  /r "LISTENING"</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{43b9bf8b-e0e3-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=7E484985CC835B3892F7445D2692227BA2D2E6F5,MD5=D0A20941751521C0D19BD3EABF34C446,SHA256=940CBEC6750076F2A191CBC8DA96AAE1905F7D9709B48C839BBD52884EFF1A45,IMPHASH=A27641A39DA5A6B0717E06BA00E56B7F</Data><Data Name='ParentProcessGuid'>{43b9bf8b-5c33-6961-8d3a-000000000800}</Data><Data Name='ParentProcessId'>7020</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T19:51:15.4771702Z'/><EventRecordID>27093</EventRecordID><Correlation/><Execution ProcessID='1556' ThreadID='5000'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1049,technique_name=System Network Connections Discovery</Data><Data Name='UtcTime'>2026-01-09 19:51:15.474</Data><Data Name='ProcessGuid'>{43b9bf8b-5c33-6961-8e3a-000000000800}</Data><Data Name='ProcessId'>6104</Data><Data Name='Image'>C:\Windows\System32\NETSTAT.EXE</Data><Data Name='FileVersion'>10.0.20348.3451 (WinBuild.160101.0800)</Data><Data Name='Description'>TCP/IP Netstat Command</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>netstat.exe</Data><Data Name='CommandLine'>netstat  -nao </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{43b9bf8b-e0e3-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2B36D7C03533E8B3DBDEC15DBB173BCB69DB2239,MD5=BDDFB67C57B9C131E5E2927C587A13ED,SHA256=8AD63014D94CF150B19B3AF2E9C5FF5EC19B7ACAFF49D97AFD3AC4C34B9DF4F8,IMPHASH=0621372A264AC3B58A59C2C28375CA74</Data><Data Name='ParentProcessGuid'>{43b9bf8b-5c33-6961-8d3a-000000000800}</Data><Data Name='ParentProcessId'>7020</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T19:51:14.3098178Z'/><EventRecordID>27061</EventRecordID><Correlation/><Execution ProcessID='1556' ThreadID='5000'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1057,technique_name=Process Discovery</Data><Data Name='UtcTime'>2026-01-09 19:51:14.269</Data><Data Name='ProcessGuid'>{43b9bf8b-5c32-6961-8b3a-000000000800}</Data><Data Name='ProcessId'>1668</Data><Data Name='Image'>C:\Windows\System32\tasklist.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Lists the current running tasks</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>tasklist.exe</Data><Data Name='CommandLine'>tasklist  /nh /fo csv</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{43b9bf8b-e0e3-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=A440302FCCCB6D181F8DB017265602397E1EB92A,MD5=2B05A9BDFAEAC5743B47A10F3F0A202B,SHA256=31E6A056EB1E722D8EC8C7E152E6A410B12D6055140BC38FFA1CCBD56AD4E623,IMPHASH=FCEA32ABE79C10DFACC88F5335DD89DE</Data><Data Name='ParentProcessGuid'>{43b9bf8b-5c32-6961-8a3a-000000000800}</Data><Data Name='ParentProcessId'>6700</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c tasklist /nh /fo csv</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T19:51:13.5687492Z'/><EventRecordID>27042</EventRecordID><Correlation/><Execution ProcessID='1556' ThreadID='5000'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-09 19:51:13.524</Data><Data Name='ProcessGuid'>{43b9bf8b-5c31-6961-843a-000000000800}</Data><Data Name='ProcessId'>4980</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{43b9bf8b-e0e3-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{43b9bf8b-5c31-6961-833a-000000000800}</Data><Data Name='ParentProcessId'>616</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T19:50:48.2707978Z'/><EventRecordID>27092</EventRecordID><Correlation/><Execution ProcessID='5904' ThreadID='5996'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-09 19:50:48.267</Data><Data Name='ProcessGuid'>{cad1564c-5c18-6961-ac3a-000000000800}</Data><Data Name='ProcessId'>6768</Data><Data Name='Image'>C:\Windows\System32\findstr.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Find String (QGREP) Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>FINDSTR.EXE</Data><Data Name='CommandLine'>findstr  /r "LISTENING"</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{cad1564c-e0a8-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=7E484985CC835B3892F7445D2692227BA2D2E6F5,MD5=D0A20941751521C0D19BD3EABF34C446,SHA256=940CBEC6750076F2A191CBC8DA96AAE1905F7D9709B48C839BBD52884EFF1A45,IMPHASH=A27641A39DA5A6B0717E06BA00E56B7F</Data><Data Name='ParentProcessGuid'>{cad1564c-5c18-6961-aa3a-000000000800}</Data><Data Name='ParentProcessId'>6216</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T19:50:48.2646866Z'/><EventRecordID>27091</EventRecordID><Correlation/><Execution ProcessID='5904' ThreadID='5996'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1049,technique_name=System Network Connections Discovery</Data><Data Name='UtcTime'>2026-01-09 19:50:48.262</Data><Data Name='ProcessGuid'>{cad1564c-5c18-6961-ab3a-000000000800}</Data><Data Name='ProcessId'>3628</Data><Data Name='Image'>C:\Windows\System32\NETSTAT.EXE</Data><Data Name='FileVersion'>10.0.20348.3451 (WinBuild.160101.0800)</Data><Data Name='Description'>TCP/IP Netstat Command</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>netstat.exe</Data><Data Name='CommandLine'>netstat  -nao </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{cad1564c-e0a8-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2B36D7C03533E8B3DBDEC15DBB173BCB69DB2239,MD5=BDDFB67C57B9C131E5E2927C587A13ED,SHA256=8AD63014D94CF150B19B3AF2E9C5FF5EC19B7ACAFF49D97AFD3AC4C34B9DF4F8,IMPHASH=0621372A264AC3B58A59C2C28375CA74</Data><Data Name='ParentProcessGuid'>{cad1564c-5c18-6961-aa3a-000000000800}</Data><Data Name='ParentProcessId'>6216</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T19:50:47.6352203Z'/><EventRecordID>27085</EventRecordID><Correlation/><Execution ProcessID='5904' ThreadID='5996'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1057,technique_name=Process Discovery</Data><Data Name='UtcTime'>2026-01-09 19:50:47.625</Data><Data Name='ProcessGuid'>{cad1564c-5c17-6961-a93a-000000000800}</Data><Data Name='ProcessId'>3148</Data><Data Name='Image'>C:\Windows\System32\tasklist.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Lists the current running tasks</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>tasklist.exe</Data><Data Name='CommandLine'>tasklist  /nh /fo csv</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{cad1564c-e0a8-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=A440302FCCCB6D181F8DB017265602397E1EB92A,MD5=2B05A9BDFAEAC5743B47A10F3F0A202B,SHA256=31E6A056EB1E722D8EC8C7E152E6A410B12D6055140BC38FFA1CCBD56AD4E623,IMPHASH=FCEA32ABE79C10DFACC88F5335DD89DE</Data><Data Name='ParentProcessGuid'>{cad1564c-5c17-6961-a83a-000000000800}</Data><Data Name='ParentProcessId'>6404</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c tasklist /nh /fo csv</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T19:50:47.3981873Z'/><EventRecordID>27078</EventRecordID><Correlation/><Execution ProcessID='5904' ThreadID='5996'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-09 19:50:47.389</Data><Data Name='ProcessGuid'>{cad1564c-5c17-6961-a73a-000000000800}</Data><Data Name='ProcessId'>5388</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{cad1564c-e0a8-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{cad1564c-5c17-6961-a63a-000000000800}</Data><Data Name='ParentProcessId'>3968</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T19:50:21.9665443Z'/><EventRecordID>27627</EventRecordID><Correlation/><Execution ProcessID='424' ThreadID='2024'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-09 19:50:21.964</Data><Data Name='ProcessGuid'>{46de3de3-5bfd-6961-db3a-000000000800}</Data><Data Name='ProcessId'>2184</Data><Data Name='Image'>C:\Windows\System32\findstr.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Find String (QGREP) Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>FINDSTR.EXE</Data><Data Name='CommandLine'>findstr  /r "LISTENING"</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{46de3de3-e0bb-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=7E484985CC835B3892F7445D2692227BA2D2E6F5,MD5=D0A20941751521C0D19BD3EABF34C446,SHA256=940CBEC6750076F2A191CBC8DA96AAE1905F7D9709B48C839BBD52884EFF1A45,IMPHASH=A27641A39DA5A6B0717E06BA00E56B7F</Data><Data Name='ParentProcessGuid'>{46de3de3-5bfd-6961-d93a-000000000800}</Data><Data Name='ParentProcessId'>5460</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T19:50:21.9610021Z'/><EventRecordID>27626</EventRecordID><Correlation/><Execution ProcessID='424' ThreadID='2024'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1049,technique_name=System Network Connections Discovery</Data><Data Name='UtcTime'>2026-01-09 19:50:21.952</Data><Data Name='ProcessGuid'>{46de3de3-5bfd-6961-da3a-000000000800}</Data><Data Name='ProcessId'>3780</Data><Data Name='Image'>C:\Windows\System32\NETSTAT.EXE</Data><Data Name='FileVersion'>10.0.20348.3451 (WinBuild.160101.0800)</Data><Data Name='Description'>TCP/IP Netstat Command</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>netstat.exe</Data><Data Name='CommandLine'>netstat  -nao </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{46de3de3-e0bb-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2B36D7C03533E8B3DBDEC15DBB173BCB69DB2239,MD5=BDDFB67C57B9C131E5E2927C587A13ED,SHA256=8AD63014D94CF150B19B3AF2E9C5FF5EC19B7ACAFF49D97AFD3AC4C34B9DF4F8,IMPHASH=0621372A264AC3B58A59C2C28375CA74</Data><Data Name='ParentProcessGuid'>{46de3de3-5bfd-6961-d93a-000000000800}</Data><Data Name='ParentProcessId'>5460</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T19:50:21.7953588Z'/><EventRecordID>46261</EventRecordID><Correlation/><Execution ProcessID='6100' ThreadID='5472'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-09 19:50:21.793</Data><Data Name='ProcessGuid'>{9f12f7c2-5bfd-6961-803b-000000000800}</Data><Data Name='ProcessId'>1148</Data><Data Name='Image'>C:\Windows\System32\findstr.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Find String (QGREP) Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>FINDSTR.EXE</Data><Data Name='CommandLine'>findstr  /r "LISTENING"</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{9f12f7c2-e0a7-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=7E484985CC835B3892F7445D2692227BA2D2E6F5,MD5=D0A20941751521C0D19BD3EABF34C446,SHA256=940CBEC6750076F2A191CBC8DA96AAE1905F7D9709B48C839BBD52884EFF1A45,IMPHASH=A27641A39DA5A6B0717E06BA00E56B7F</Data><Data Name='ParentProcessGuid'>{9f12f7c2-5bfd-6961-7e3b-000000000800}</Data><Data Name='ParentProcessId'>6148</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T19:50:21.7892865Z'/><EventRecordID>46260</EventRecordID><Correlation/><Execution ProcessID='6100' ThreadID='5472'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1049,technique_name=System Network Connections Discovery</Data><Data Name='UtcTime'>2026-01-09 19:50:21.785</Data><Data Name='ProcessGuid'>{9f12f7c2-5bfd-6961-7f3b-000000000800}</Data><Data Name='ProcessId'>5568</Data><Data Name='Image'>C:\Windows\System32\NETSTAT.EXE</Data><Data Name='FileVersion'>10.0.20348.3451 (WinBuild.160101.0800)</Data><Data Name='Description'>TCP/IP Netstat Command</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>netstat.exe</Data><Data Name='CommandLine'>netstat  -nao </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{9f12f7c2-e0a7-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2B36D7C03533E8B3DBDEC15DBB173BCB69DB2239,MD5=BDDFB67C57B9C131E5E2927C587A13ED,SHA256=8AD63014D94CF150B19B3AF2E9C5FF5EC19B7ACAFF49D97AFD3AC4C34B9DF4F8,IMPHASH=0621372A264AC3B58A59C2C28375CA74</Data><Data Name='ParentProcessGuid'>{9f12f7c2-5bfd-6961-7e3b-000000000800}</Data><Data Name='ParentProcessId'>6148</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T19:50:20.8476477Z'/><EventRecordID>46235</EventRecordID><Correlation/><Execution ProcessID='6100' ThreadID='5472'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1057,technique_name=Process Discovery</Data><Data Name='UtcTime'>2026-01-09 19:50:20.842</Data><Data Name='ProcessGuid'>{9f12f7c2-5bfc-6961-7c3b-000000000800}</Data><Data Name='ProcessId'>4336</Data><Data Name='Image'>C:\Windows\System32\tasklist.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Lists the current running tasks</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>tasklist.exe</Data><Data Name='CommandLine'>tasklist  /nh /fo csv</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{9f12f7c2-e0a7-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=A440302FCCCB6D181F8DB017265602397E1EB92A,MD5=2B05A9BDFAEAC5743B47A10F3F0A202B,SHA256=31E6A056EB1E722D8EC8C7E152E6A410B12D6055140BC38FFA1CCBD56AD4E623,IMPHASH=FCEA32ABE79C10DFACC88F5335DD89DE</Data><Data Name='ParentProcessGuid'>{9f12f7c2-5bfc-6961-793b-000000000800}</Data><Data Name='ParentProcessId'>5804</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c tasklist /nh /fo csv</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T19:50:20.5990713Z'/><EventRecordID>27600</EventRecordID><Correlation/><Execution ProcessID='424' ThreadID='2024'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1057,technique_name=Process Discovery</Data><Data Name='UtcTime'>2026-01-09 19:50:20.592</Data><Data Name='ProcessGuid'>{46de3de3-5bfc-6961-d73a-000000000800}</Data><Data Name='ProcessId'>4152</Data><Data Name='Image'>C:\Windows\System32\tasklist.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Lists the current running tasks</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>tasklist.exe</Data><Data Name='CommandLine'>tasklist  /nh /fo csv</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{46de3de3-e0bb-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=A440302FCCCB6D181F8DB017265602397E1EB92A,MD5=2B05A9BDFAEAC5743B47A10F3F0A202B,SHA256=31E6A056EB1E722D8EC8C7E152E6A410B12D6055140BC38FFA1CCBD56AD4E623,IMPHASH=FCEA32ABE79C10DFACC88F5335DD89DE</Data><Data Name='ParentProcessGuid'>{46de3de3-5bfc-6961-d63a-000000000800}</Data><Data Name='ParentProcessId'>2124</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c tasklist /nh /fo csv</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T19:50:20.3547313Z'/><EventRecordID>46223</EventRecordID><Correlation/><Execution ProcessID='6100' ThreadID='5472'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-09 19:50:20.336</Data><Data Name='ProcessGuid'>{9f12f7c2-5bfc-6961-753b-000000000800}</Data><Data Name='ProcessId'>6056</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{9f12f7c2-e0a7-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{9f12f7c2-5bfc-6961-743b-000000000800}</Data><Data Name='ParentProcessId'>7064</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T19:50:19.9771098Z'/><EventRecordID>27584</EventRecordID><Correlation/><Execution ProcessID='424' ThreadID='2024'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-09 19:50:19.956</Data><Data Name='ProcessGuid'>{46de3de3-5bfb-6961-d03a-000000000800}</Data><Data Name='ProcessId'>5680</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{46de3de3-e0bb-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{46de3de3-5bfb-6961-cf3a-000000000800}</Data><Data Name='ParentProcessId'>3136</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T18:57:47.4204653Z'/><EventRecordID>26901</EventRecordID><Correlation/><Execution ProcessID='6004' ThreadID='5224'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-09 18:57:47.416</Data><Data Name='ProcessGuid'>{d5955fcb-4fab-6961-fe39-000000000800}</Data><Data Name='ProcessId'>4612</Data><Data Name='Image'>C:\Windows\System32\findstr.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Find String (QGREP) Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>FINDSTR.EXE</Data><Data Name='CommandLine'>findstr  /r "LISTENING"</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{d5955fcb-e24e-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=7E484985CC835B3892F7445D2692227BA2D2E6F5,MD5=D0A20941751521C0D19BD3EABF34C446,SHA256=940CBEC6750076F2A191CBC8DA96AAE1905F7D9709B48C839BBD52884EFF1A45,IMPHASH=A27641A39DA5A6B0717E06BA00E56B7F</Data><Data Name='ParentProcessGuid'>{d5955fcb-4fab-6961-fc39-000000000800}</Data><Data Name='ParentProcessId'>6532</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T18:57:47.4121128Z'/><EventRecordID>26900</EventRecordID><Correlation/><Execution ProcessID='6004' ThreadID='5224'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1049,technique_name=System Network Connections Discovery</Data><Data Name='UtcTime'>2026-01-09 18:57:47.408</Data><Data Name='ProcessGuid'>{d5955fcb-4fab-6961-fd39-000000000800}</Data><Data Name='ProcessId'>3676</Data><Data Name='Image'>C:\Windows\System32\NETSTAT.EXE</Data><Data Name='FileVersion'>10.0.20348.3451 (WinBuild.160101.0800)</Data><Data Name='Description'>TCP/IP Netstat Command</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>netstat.exe</Data><Data Name='CommandLine'>netstat  -nao </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{d5955fcb-e24e-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2B36D7C03533E8B3DBDEC15DBB173BCB69DB2239,MD5=BDDFB67C57B9C131E5E2927C587A13ED,SHA256=8AD63014D94CF150B19B3AF2E9C5FF5EC19B7ACAFF49D97AFD3AC4C34B9DF4F8,IMPHASH=0621372A264AC3B58A59C2C28375CA74</Data><Data Name='ParentProcessGuid'>{d5955fcb-4fab-6961-fc39-000000000800}</Data><Data Name='ParentProcessId'>6532</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>